Setting up an iptables firewall

This document consists of two parts. The first is setting up a firewall (using iptables) on the HN, which will restrict traffic to the containers. The effect would emulate, as far as the containers and their customers are concerned, an external hardware firewall controlled by the sysadmin. The second is setting up a firewall that protects the HN itself but still allows traffic to the containers, thus allowing individual containers to define their own iptables.

While the firewalls shown here can be accomplished using iptables manually (or using Fedora core's iptables service), the methods presented here are especially modular and easy to modify. This is important when you have 20+ containers and a lot of other things to be doing...

The scripts and pathnames given here are for Fedora Core 6, though they can probably be applied to most similar SysV-like systems with little modification.

On our systems, we use the HN to provide privileged services which are not appropriate for access by the containers. For example, the HN acts as a backup server, runs Nagios for health monitoring, has a webserver for managing the 3ware RAID controller, etc. The containers are leased to customers, who can't entirely be trusted, especially if they get hacked. As such, our scenario is one in which the HN must be protected from all access (even from the containers) except for a few trusted hosts (e.g. my home-office).

The exception to this is the nameserver, which we want open to the world. We use it as a caching nameserver for our containers and also to host DNS for a few customer domain.

Vzfirewall tool allows you to open/close ports for incoming connections with no dependencies to foreign IP addresses. E.g. you may allow a hostname release.prod.example.com to connect to port 5432 of VE 1234 and leave all other ports closed by modifying 1234.conf file adding multiline FIREWALL directives into it:

You must then run vzfirewall -a on your hardware node to apply changes made in *.conf.

Note that it is recommended to use hostnames instead of IP addresses here, so the configuration is persistent for VE movements to different IP-address: you just need to run vzfirewall -a again after movement. It is also reboot-safe, as the rules are applied to /etc/sysconfig/iptables (at RHEL systems).

For those who might find the solution provided in this wiki article unsatisfactory (for whatever reason), the creator of Shorewall (Tom Eastep) has written a nice article explaining how to use Shorewall on an OpenVZ host node to manage the host node, containers, and more... with quite a complex setup as an example. The article IS NOT an introduction to Shorewall for beginners, so some pre-existing knowledge and understanding of Shorewall may be required.

This setup emulates (to the containers anyway) an external hardware firewall. It protects the HN from any access and then defines what services and ports are allowed/banned for individual containers. This leaves the firewall controlled by the site administrator, not be individual containers and the hackers who've gotten into them. ;)

First off, let's disable Fedora's existing iptables service:

service iptables stop
chkconfig iptables off

Now create the new firewall service. This code should be /etc/init.d/firewall and then should be chmod'd 755.

Note: This will only allow access to the HN from the hosts/networks defined in SEGMENT. If you'd like to open up the OKPORTS on the HN to everybody, you can remove the -s $SEGMENT parameters from the iptables commands under the "Firewall: Allowing access to HN" section. The modified lines would look like this:

service firewall start
service firewall stop
service firewall restart
service firewall status

It will set up the firewall for the HN according to the parameters you specified for OKPORTS, DMZs, etc. and then it will call each file under /etc/firewall.d and process its configuration.

So create a file under /etc/firewall.d The exact filename isn't important, as long as it's meaningful to you, e.g. ExampleCompany or ve12 and give it content like this:

# This file is processed by /etc/init.d/firewall
CTID="1" # the container's ID#
CTNAME="Customer1" # A human-friendly label for the container
CTIP="192.168.1.34" # the IP address for this container
OPENPORTS="80 443" # ports that should be universally opened
# to the entire Internet
DMZS="1.2.3.0/24 5.6.7.8/32" # IPs and blocks that should have full access
# to the container's services
BANNED="" # IPs and blocks that should be entirely
# blocked from the container's services

And there you go.

Note: You can only put one IP address inside the CTIP variable, but if your container has multiple IP addresses you can create a copy of the file for each IP address.

Go ahead and start the firewall and check its status:

service firewall restart
service firewall status

As you can see, you can now add and edit the configurations for individual containers very easily. This method proves a lot easier to manage than Fedora's iptables-config mechamism!

To make the firewall service automatically start when the HN boots, run

This setup configures iptables on the HN to disallow access to all hosts, including the containers. However, it allows all traffic into the containers so they may define their own iptables rules and therefore manage their own firewall.

iptables -P FORWARD ACCEPT
iptables -F FORWARD

This will remove all rules for the FORWARD chain so all packets can pass back and forth between containers and the outside world.

If you want to use a firewall inside a container, please load these modules BEFORE starting the container:

modprobe xt_tcpudp
modprobe ip_conntrack

If you do not, you will get an error like this: "iptables: No chain/target/match by that name"

Note: xt_tcpudp module seem to be included in the kernel packages of Debian 6, but not of CentOS 6.

If you want to use stateful firewall rules (and you should!) you will also need to make sure that 'ipt_state' is in the 'IPTABLES' option in your vz.conf file: